Writing Admin/User/Public controllers to insure authentication

In my opinion, putting an autoload inside... wherever (some people put it into config, some people put it into main index.php)... is  a bit hack'ish... That is because, after you've done that you may have forgotten where you've put it.

Agreed it's a bit hackish. I'm not especially worried about forgetting where it is and would argue that it'd probably be easier to forget about one's hooks than one's config file. The hook syntax also a bit impenetrable. I'm more concerned that this is a config file. On the other hand, sort of makes on wonder if autoloaders are configuration or something else...

Hobbes' suggestion is no better than the first method, that is because is not a good practice, you simply put the autoload inside a MY_Controller.

Technically speaking, it's not an autoloader but specific require instructions. Still, awkward to have include/require statements in a class definition file.

On the other hand we have the hooking system which, logically seems better than the first options. That is because we establish an order of loading the classes, and also we know from the start where to look for the autoloader.

Unless I'm mistaken, autoloaders needn't worry about the sequence of class loading because their job is to automatically fetch class definitions as needed. If we put the require/include statements in MY_ROUTER, this would also specify a load sequence.

Another method, which I think would be the best but I didn't have the time to look into (that is "I don't know yet how to implement"...) would be to use the Composer and then use namespacing when defining and asking for the necessary controller.

Agreed that namespacing is a concern in CI. If you want nice simple class names for your controllers (e.g.,"Search") then you will probably end up using complicated names somewhere else -- or encountering a name collision.